Remove 'all' option from TargetRegions parameter

## Problem

The `TargetRegions` deployment parameter currently accepts a special `all` value that fans the assessment out across every region where the assessed services are available. In practice this causes two problems:

- **Very long assessment runs.** Scanning the full commercial-partition region catalog multiplies Step Functions Map iterations and Lambda invocations, substantially increasing elapsed time and cost.
- **Oversized HTML reports.** Consolidating findings from every region produces reports large enough to be slow to open and hard to navigate.

For newer services (AgentCore, AWS Agent Registry) that do not publish endpoint-region metadata, `all` also conservatively includes the entire region catalog, so most of the added iterations only produce informational `N/A` rows.

## Proposed change

Remove the `all` value entirely. Scans should target either:

- the deployment region (default — empty `TargetRegions`), or
- an explicit comma- or space-separated region list.

This keeps the common, predictable cases and removes the footgun. Operators who genuinely want broad coverage can pass an explicit list.

## Scope

- `TargetRegions` `AllowedPattern` in all four SAM/deployment templates
- `buildspec.yml` validation gate for direct CodeBuild triggers
- `README.md` and `docs/TROUBLESHOOTING.md` guidance
- Region-normalization fallbacks in `resolve_regions` and the Responsible AI GRC
assessment

## Deployment impact

Breaking parameter change: any stored value or automation passing `TargetRegions=all` must move to an empty value or explicit region list before the next deployment/CodeBuild run.